Forgery and amplification

A forged answer has to match the transaction ID, arrive at the right source port, and echo the question exactly — including its case. Those are independent, so the bits add.

• Transaction ID16

  Drawn from crypto/rand, never math/rand. A predictable sequence gives the whole defence away.

• Source port~15

  The kernel picks it, per RFC 6056. The socket is dialled rather than opened with ListenPacket, so datagrams from any other address are dropped before this process sees them.

• 0x20 case1 per letter

  Every ASCII letter in the query name is set or cleared at random. Three for a.io, ten for example.com, thirteen for www.example.com.

The case pattern is a nonce that protects the path, not the server at the end of it: a compromised nameserver echoes it back correctly. And not every server conforms — some lowercase the question. A hard refusal with no way back would make this resolver fail against real infrastructure, so a server found not to preserve case is recorded after one clean attempt and asked plainly from then on.

That fallback is not a way to switch the defence off. It is reached only after the exchange's whole deadline has passed with nothing usable arriving, so an attacker sending a wrong-case reply must also stop the real answer from arriving at all.

A DNS query is small and an answer is large, so a resolver reachable from the internet is a way to turn a 60-octet packet carrying somebody else's source address into a 500-octet packet aimed at them. The limit is on responses rather than queries, because what matters is what leaves.

Over the limit, the answer is dropped rather than refused — an error is a response, and a response is what the attack wants. But dropping everything would cut off real clients behind a busy network, so every second one over the limit is answered with the truncation bit set instead. A genuine client reads that as “ask again over TCP” and succeeds, because TCP is exempt; a spoofed source cannot complete the handshake and gets nothing.

Client networks

/24 for IPv4, /56 for IPv6

Default rate

20 responses a second

Slip

every 2nd over-limit answer truncated

Exempt by default

127.0.0.0/8, ::1/128

Tracked networks

10,000, least recently seen evicted

A network seen for the first time gets one second's allowance rather than the full window, so inventing new source networks is not a way to collect free responses. Under a flood from many forged sources the eviction removes the forgeries, because the network actually being answered is touched on every packet and stays at the front.

DNSSEC is not implemented. EDNS0 is present and the DO bit is decoded, but nothing is validated, so a forged delegation from a compromised parent would not be detected. That is a deliberate omission rather than an unfinished one: half-done validation is worse than none, because a resolver reporting AD on evidence it did not check lies to everything downstream.